<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.apihooks.ApiHooks.whitelist : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="method">v.p.m.a.A.whitelist(self, rule_key, process, src_mod, dst_mod, function) : method documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.apihooks.html">apihooks</a>.<a href="volatility.plugins.malware.apihooks.ApiHooks.html">ApiHooks</a></span>
      
      
    </p>
    <div>
      
    </div>
    <div>Check if an API hook should be ignored due to whitelisting.</p>
<dl class="rst-docutils">
<dt>&#64;param rule_key: a key from the whitelist_rules dictionary which</dt>
<dd>describes the type of hook (i.e. Usermode IAT or Kernel Inline).</dd>
</dl>
<p>&#64;param process: name of the suspected victim process.</p>
<dl class="rst-docutils">
<dt>&#64;param src_mod: name of the source module whose function has been</dt>
<dd>hooked. this varies depending on whether we're dealing with IAT
EAT, inline, etc.</dd>
<dt>&#64;param dst_mod: name of the module that is the destination of the</dt>
<dd>hook pointer. this is usually the rootkit dll, exe, or sys,
however, in many cases there is no module name since the rootkit
is trying to be stealthy.</dd>
</dl>
<p>&#64;param function: name of the function that has been hooked.<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      
      
      
    </div>
    
    
    

    
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>